You can't.

The WPScan tool is an automated utility that takes advantage of WordPress' friendly URLs to determine usernames.  [It will loop through][1] the first 10 possible IDs for authors and check the `Location` header on the HTTP response to find a username.

Using `http://mysite.url` for example ...

WPScan will check `http://mysite.url/?author=1`.  If your site is using pretty permalinks, it will return a 301 redirect with a `Location` header of `http://mysite.url/author/username`.  If your site *isn't* using pretty permalinks, it will return a status of 200 (OK) instead, so WPScan will check the feed for the string "posts by username" and extract the username.

# What you can do

First of all, just because someone can guess your username, doesn't mean your site is insecure.  And there is really no way you can prevent someone from parsing your site in such a way.

**However ...**

If you are really concerned about this, I would recommend doing two things:

1. **Turn off pretty permalinks.** This will force WPScan and similar tools to parse the content of your site for usernames rather than relying on the URL.
1. **Force users to set a different nickname.** In the absence of a username in the URL, scanning tools will search for "posts by username" in the feed/post content instead.  If you aren't putting usernames out there, then they can't be nabbed.

Another alternative is to change your author permalink rewrites.  There are several ways you can do this, and you can probably [find a few on this site as well][2].


  [1]: http://code.google.com/p/wpscan/source/browse/trunk/lib/discover.rb#178
  [2]: https://wordpress.stackexchange.com/questions/5275/author-url-rewrite